The enforcement model
Job execution contract
The public Job contract supports the following platform ceilings:
The 59-minute ceiling is deliberate. Work that can exceed it should be split into checkpointed, idempotent Jobs rather than relying on a continuously held worker.
Endpoint and Sandbox limits
Endpoint limits are optimized for synchronous caller deadlines and may be lower than Job ceilings. The effective timeout and memory depend on the instance quota and Endpoint configuration. Set an Endpoint timeout below the upstream load balancer or client deadline so the caller receives a controlled platform error. Sandbox and Playground executions have separate validation intended for interactive development. They do not raise the ceiling of the Endpoint or Job that will run in production. Always test the final deployed surface with its real configuration and principal.Other governed limits
Capacity is not limited to CPU time and memory. Instance settings also govern product areas such as:- numbers of accounts, Permission groups, Components, Endpoints, and automation definitions;
- execution deadlines, memory, and supported concurrency policy;
- native Storage and Database capacity thresholds;
- audit and log retention;
- webhook retry policy;
- Agent, Assistant, and integration entitlements.
__ are reserved by the platform.
What happens at a boundary
Timeout and infrastructure failure are ambiguous around remote systems. Before retrying, verify whether the external call committed and use a durable idempotency key.
Usage and soft thresholds
Open Settings → Usage for AI, Transfer, Storage, Database, Jobs, Endpoints, and Webhooks. Use Quick, Custom, or Range to inspect up to 366 days. A selected analysis range is independent of the fixed UTC calendar month used for monthly usage comparisons. API ranges includefrom and exclude to.
Storage, Database, monthly external transfer, Job processing hours, and Endpoint processing hours use soft thresholds. Exceeding one does not prevent a Database write or execution. Timeout, memory, structural validation, and other enforced quotas continue to apply.
Native Storage reports physical bytes across namespaces, including retained versions, archives, temporary upload objects, and soft-deleted objects until they are physically destroyed. A reference to the same stored object is not an additional object. Storage does not have a separate legacy Files capacity quota. The technical per-upload ceiling is 100 GiB.
Transfer separates observed incoming and outgoing traffic into external, internal · free, and unclassified categories. Creating a file is not a transfer measurement. Partial coverage and source timestamps are visible; missing measurements must not be interpreted as zero traffic. Capacity snapshots and imported traffic can arrive later than the operation itself.
Component version history is always retained. RAW_SQL and low-code database queries are available without an instance feature switch; roles and query safety rules still apply. Realtime transport has no channel or message quota statistics in Usage.
Operator workflow
- Check the instance setting for the capability and environment.
- Configure the smallest timeout, memory, and concurrency budget that safely handles the workload.
- Validate the definition and execute a representative test.
- Observe peak duration, heap, payload, and downstream latency.
- Increase capacity only after confirming the actual constrained boundary.
- Re-test the deployed Endpoint, Job, Schedule, or dashboard widget—not only Playground.
Production guidance
- Treat quotas as policy and capacity controls, not targets to consume.
- Keep production and non-production instances independently configured.
- Alert before sustained capacity exhaustion.
- Split workflows that approach 59 minutes into recoverable stages.
- Bound concurrency around the protected dependency.
- Keep payloads and metadata small; place large artifacts in Storage.
- Record any quota increase with an owner, reason, and rollback threshold.